People have the right to be forgotten, rules EU court

People should be able to ask Google to 'delete' information
about them that they'd like to be forgotten from its search engine
results, even when that data is published on third party sites,
ruled Europe's highest court today (13 May).

"If, following a search made on the basis of a person's name,
the list of results displays a link to a web page which contains
information on the person in question, that data subject may
approach the operator directly and, where the operator does not
grant his request, bring the matter before the competent
authorities in order to obtain, under certain conditions, the
removal of that link from the list of results," said the judges
from the Court of Justice of the European Union in a
ruling.

One person's right to be forgotten may be another
person's right to remember

Whether or not people should have the "right to be forgotten"
has been a subject of debate for a number of years. Today's ruling
relates to a case between Google and the Spanish data protection
agency. It was triggered in 2010 when Spanish national Mario
Costeja González complained to the Agencia Española de Protección
de Datos that when anyone searched for his name in Google, the top
results would contain two links to a 1998 story on newspaper La
Vanguardia's website about an auction for his repossessed home. He
argued that Google's search results represented an infringement of
his privacy. 180 similar cases in Spain came forward, all of whom
wanted Google to stop indexing personal information about them --
effectively deleting it from the web.

Costeja González initially requested that La Vanguardia be
required either to remove or alter the pages in question. The data
protection agency rejected that complaint saying that it had been
lawfully published and was accurate. The complaint against Google
was upheld, and the search giant was asked to withdraw data from
its index so that people could no longer access the stories. Google
brought action to Spain's high court seeking to overturn the
decision, which led the case to being referred to the
Luxembourg-based European Court of Justice.

Critics of the right to be forgotten -- including Google -- say
that removing legal but undesirable information from the web is
tantamount to censorship. Secondly, Google does not host the data,
it merely points to it, and therefore should not be responsible for
policing the data.

Today's ruling suggests that search engines are, in fact,
responsible for the content that they point to -- a responsibility
that search engines have traditionally shirked. This could
potentially open a huge can of worms for Google and other search
engines who are likely to be faced with a flood of similar requests
from across Europe.

The ruling is particularly surprising as in June 2013, the
Advocate General for the Court of Justice of the European Union
Niilo Jääskinen, ruled that giving data subjects a right to be forgotten would
"entail sacrificing pivotal rights such as freedom of expression
and information" and should not even be considered on a
case-by-case basis since it would give search engines the awkward
role of web censor.

The judges said that "by searching automatically, constantly and
systematically for information published on the internet, the
operator of a search engine 'collects' data" according to EU data
protection law. In the process of indexing websites, Google
"'retrieves', 'records' and 'organises' the data in question, which
it then 'stores' on its servers and, as the case may be,
'discloses' and 'makes available' to its users in the form of lists
of results". This must be considered processing data, and as a
consequence, Google is a data controller and must be responsible
for the content contained in the links even if the information has
already been published by a media organisation.

There are a huge number of issues with the right to be
forgotten. Perhaps the most glaringly obvious one is that one
person's right to be forgotten may be another person's right to
remember. Whose right wins out in this case? In the ruling, the
judges recognise that there may be a public interest in the
information someone wants deleted and that "fair balance" between
that interest and the data subject's right to privacy should be
sought.

A Google spokesperson said: "This is a disappointing ruling for
search engines and online publishers in general. We are very
surprised that it differs so dramatically from the Advocate
General's opinion and the warnings and consequences that he spelled
out. We now need to take time to analyse the implications."

Updated 11:05 13/05/2014: This article has been
updated to include a comment from Google.